Do not reveal sensitive Data

[cocker-cc]

Allow Passwords to be of Puppet-Datatype Sensitive.
Return Sensitive, if Passwords were provided as Sensitive.

[ekohl]

For this block I was thinking about refactoring it (prior to your change):

cls = case resource[:authentication]
      when :dsa
        OpenSSL::PKey::DSA
      when :rsa
        OpenSSL::PKey::RSA
      when :ec
        OpenSSL::PKey::EC
      else
        raise
      end

cls.new(file, resource[:password])

Then with your change it becomes

cls = case resource[:authentication]
      when :dsa
        OpenSSL::PKey::DSA
      when :rsa
        OpenSSL::PKey::RSA
      when :ec
        OpenSSL::PKey::EC
      else
        raise
      end

if resource[:password].respond_to?(:unwrap)
  Puppet::Pops::Types::PSensitiveType::Sensitive.new(cls.new(file, resource[:password].unwrap))
else
  cls.new(file, resource[:password])
end

But realistically, why don't we use OpenSSL::Pkey.read(file, resource[:password]) to let OpenSSL do the heavy lifting? Is that method unavailable in older versions? If so, how old?

[ekohl]

#189 does that.

[cocker-cc]

I am no Expert with OpenSSL. I suggest to leave that Change in #189